From the 2026-07-06 codebase audit (docs/audits/codebase-audit-2026-07-06.md, in-repo). Finding IDs are stable — cite them in fixes.
Severity: Critical (C6) + High (C28) + Medium (C63) · Status: CONFIRMED (independently re-verified; self-reference mechanism PLAUSIBLE)
Problem
The demo site never consumes packages/*/src:
- All six examples import
@elastica → tsconfig path alias → ../dist/elastica-react.mjs, the committed minified artifact (website/tsconfig.json:47-48).
- Types come from
website/lib/utils/elastica.d.ts — a 247-line hand-written ambient module duplicating the generated dist/react/*.d.ts and already drifting (C28): it erases boxes nullability (example-1.tsx:81 compiles only because of that erasure — against real types it's a TS error and a runtime crash when an element unmounts mid-frame), misses ElementData.shape, and misses several exports. Nothing checks the shim against the real types; it rots silently on every API change.
dist/elastica-react.mjs imports @darkroom.engineering/elastica, which exists in no node_modules — resolution most plausibly works via Node package self-reference through the root package.json name+exports (fingerprint evidence: the local-dist-only typo calculatecCollisions appears in the built .next chunks).bun.lock additionally resolves packages/react's "*" peer to the npm-published 0.0.14 — a third, 14-versions-stale engine copy linked under packages/react/node_modules/ (where IDE go-to-definition can land).- C63: the library externalizes hamo
0.6.46 while website code imports hamo 1.0.0-dev.7 — two hamo implementations ship in one client bundle.
Failure scenario
Contributor fixes a collision bug in packages/engine/src/, runs bun run dev:website, reloads — behavior unchanged; nothing anywhere says you must bun run build first. Four sources of truth for one API (src, dist, shim, readme) connected only by human discipline.
Direction
Make the website depend on the workspace packages by name (bun links them natively; Next transpiles workspace deps); delete the alias and the shim; let exports.types do its job. Or, at minimum: wire dev:website to run engine/react watch builds concurrently and document the dist pipeline. (Audit design tension 3; open question 19: if the website must run standalone, the ../dist alias can't survive at all.)
Severity: Critical (C6) + High (C28) + Medium (C63) · Status: CONFIRMED (independently re-verified; self-reference mechanism PLAUSIBLE)
Problem
The demo site never consumes
packages/*/src:@elastica→ tsconfig path alias →../dist/elastica-react.mjs, the committed minified artifact (website/tsconfig.json:47-48).website/lib/utils/elastica.d.ts— a 247-line hand-written ambient module duplicating the generateddist/react/*.d.tsand already drifting (C28): it erasesboxesnullability (example-1.tsx:81 compiles only because of that erasure — against real types it's a TS error and a runtime crash when an element unmounts mid-frame), missesElementData.shape, and misses several exports. Nothing checks the shim against the real types; it rots silently on every API change.dist/elastica-react.mjsimports@darkroom.engineering/elastica, which exists in no node_modules — resolution most plausibly works via Node package self-reference through the root package.json name+exports (fingerprint evidence: the local-dist-only typocalculatecCollisionsappears in the built.nextchunks).bun.lockadditionally resolves packages/react's"*"peer to the npm-published 0.0.14 — a third, 14-versions-stale engine copy linked underpackages/react/node_modules/(where IDE go-to-definition can land).0.6.46while website code imports hamo1.0.0-dev.7— two hamo implementations ship in one client bundle.Failure scenario
Contributor fixes a collision bug in
packages/engine/src/, runsbun run dev:website, reloads — behavior unchanged; nothing anywhere says you mustbun run buildfirst. Four sources of truth for one API (src, dist, shim, readme) connected only by human discipline.Direction
Make the website depend on the workspace packages by name (bun links them natively; Next transpiles workspace deps); delete the alias and the shim; let
exports.typesdo its job. Or, at minimum: wiredev:websiteto run engine/react watch builds concurrently and document the dist pipeline. (Audit design tension 3; open question 19: if the website must run standalone, the../distalias can't survive at all.)